Customer – your customer’s employee(s) come to audit your company. They may use different standards.
Supplier - your employee(s) may also go out and audit the company that supplies you with a product or service
AIB or a similar agency.

“First-party audits are usually done in-house and are typically performed by the company or a department within the company upon itself,” said Jacoby. She said at TIC Gums, audits are done monthly. A committee does the GMP internal audit, an ISO committee team does ISO audits and there’s also OSHA safety audits performed. “Some organizations may be small enough that you only have one person who does all the audits. Others, depending on what it is, will have several,” said Jacoby. The lead auditee should be someone who has the knowledge – who knows and understands the standard, stressed Jacoby. But she also cautioned a new employee who knows the standard well may not know the organization well and may have difficulty finding the needed information. “So when the auditor is there, you want to feel confident that you have someone who is very knowledgeable on all accounts so that you’re not fumbling,” Jacoby said. She added that it’s important to have the lead auditee be someone who will be readily available during the audit.
Jacoby said the auditee’s general demeanor should be friendly, honest, polite, cooperative, respectful and professional. “You should think of it almost like the duck – they’re sailing across the water and they’re looking great but underneath their little feet are paddling a mile a minute and all you want to give is the impression that everything’s calm and this is the way we always do it,” said Jacoby. “A positive attitude is a must,” she added. “Errors may be discovered but it’s how you handle them that counts. Life is 10 percent what happens to you and 90 percent how you react to it.”
Jacoby said some people question the need to have an audit plan. “Well, some audits are announced and some are unannounced,” she said. “So, if you have a plan, you’ll be ready for those unannounced audits.”
Jacoby said an audit plan should cover all types of audits. She stressed everyone, including the receptionist, should know his/her role in the audit process. “Your receptionist may be your first line of defense. You may have a temp that day and the FDA inspector won’t care that this person has only been at your facility for five minutes,” Jacoby said. “Part of your training for the receptionist should include a copy of your audit plan. If someone comes to the door and identifies himself as an inspector, you can open this and you’ll know exactly what to do.
Some larger organizations have put it on a laminated card that everyone in the facility carries in their pocket so when they hear an FDA auditor is at their door, they pull out their card and they have it all covered.”
A plan should include the receptionist first asking for credentials and written notice of inspection. Jacoby said. She emphasized not to leave the inspector alone for any reason. Upon checking the credentials, the receptionist should then notify the primary contact or other designated management team member.
Jacoby said TIC Gums has five people identified to contact if an inspector arrives. While Jacoby is first on the list, there are second, third, fourth and fifth contacts to pursue in her absence. Signage is visibly displayed in TIC Gums’ facility which spells out that no cell phones are allowed, something Jacoby said has become more important now with the camera function on phones. “If you have this policy, make the inspector aware of it,” Jacoby said. Jacoby said TIC Gums asks people to leave their cell phone in their car or with the receptionist. No cameras or recording devices are permitted.
The first thing the primary contact person should do is to ask for the reason of inspection, Jacoby said. The next step would be to again inspect the credentials and notice of inspection. If the inspection appears to be related to potential criminal action, the contact should notify legal counsel. If it’s just a routine inspection, notify others on the management team.
“You will also want to monitor the inspector and take notes,” said Jacoby. “And what’s important to know during an FDA inspection is that you don’t have to show them everything they ask for necessarily. That’s why you need to know the standard. You need to know what they can ask you about. They could potentially ask for everything and if you don’t know what you have to show them, you may be giving them more information than what they need and you may be opening yourself up to more exposure.” Jacoby advised if samples are requested, receive a portion and note how it was taken You should also request a copy of the results and have a receipt of what was taken. Do not sign anything except a document confirming maintenance of interstate shipments, she added. “If they want you to sign something, just take it, put it down and say you’ll review it with legal counsel and get back to them on it,” Jacoby said. “What I’ve been told is even if you glance at it and know that something is misspelled, i.e. the company name or your name, and you mention there’s a misspelling, then they assume you’ve read the whole thing and are in agreement with it and you don’t necessarily want that.”
Basic information Jacoby said should be ready for any type of audit includes the company’s quality manual, quality policy, organizational charts and process flow charts. She recommended having a hard copy of this information easily available. Depending on the audit, other information will be needed. In a HACCP audit, Jacoby said, the auditor may not want to just see a HACCP plan. “They’ll want to see your documentation of the HACCP checks and that your CCPs are covered, what your corrective action is if something goes out of spec and things of that nature. When reviewing training records, they’ll want to see if the production workers are trained in GMP and whether they are retrained annually.
“If you know what you’re being audited for, you’re going to have the correct training records for them,” said Jacoby. “It just makes it go comfortably and everyone feels better while it’s going smoothly. You want to minimize disruptions as much as possible. Give everyone as much notice as possible. And whenever possible, know what the audit criteria will be – the data or documents that might be reviewed and records that may be request for which time period. It’s best to ask for this information up front as it gives you a starting place and enables you to prepare for the audit.”